PC Engines apu2 experiences

dugeem

pfSense 2.3-RC - FreeBSD 10.3 - OpenSSL 1.0.1s

With aesni kernel module loaded:

openssl speed -elapsed -evp aes-128-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc       1415.24k     5719.32k    20972.71k    64425.98k   165052.42k

openssl speed -elapsed -evp aes-256-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-cbc       1422.00k     5596.20k    19954.86k    58028.03k   128863.18k

With aesni kernel module unloaded (i.e. use openssl internal AES-NI support):

openssl speed -elapsed -evp aes-128-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc     118951.32k   174348.44k   215569.58k   226972.33k   229908.48k

openssl speed -elapsed -evp aes-256-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-cbc     100858.39k   136414.06k   157968.73k   164130.47k   166958.42k

Nice and interesting thread about the new APU2 board.

For the APU I can say we were getting something around ~500+ MBit/s at the WAN Port and with enabled
PowerD (hi adaptive) we got ~650 MBit/s as throughput. Perhaps this will be different from the APU2 with
a quad core CPU. But otherwise I would recommend to enable PowerD (hi adaptive).

My apu2b4 is running pfSense 2.2.6 with BIOS 160120 and a Toshiba mSata SSD. Previously was running an alix 2d13.

Would you share the full name of the mSATA please? Another user is searching for one that is 100% compatible
with pfSense and able to support TRIM too. Thread about that

Upstream my apu2 has 2 WANs - a 34Mb/s HFC/DOCSIS service (IPv4 only) and a 10Mb/s DSL line (IPv4 & IPv6). The Alix could manage this bandwidth okay but throw in incoming requests to a NTP pool server (~2k - 20k states) and the memory was getting tight.

What I was not really getting out of your thread here is the following;
What kind of APU2xx you are running now exactly? With 2 GB or 4 GB of RAM?
And why the older Alix board was not running out of RAM? It has less then the APU as I know it, or?
As I know it it must be something like this
APU2B2 (2 GB)
APU2B4 (4 GB)
APU2C2 (2 GB)
APU2C4 (4 GB)

The name of this boards is likes the following;
APU2A4 = Alpha series (not for the public)
APU2B4 = Beta series (production ready but any hardware and BIOS can be changed)
APU2C4 = Consumer series (production ready but some hardware only and/or BIOS can be changed)
APU2D4 = Distributed series (production ready and only the BIOS code will be perhaps changed)

If someone is bricking his BIOS there is also even a BIOS recovery solution for nearly all PC Engines Boards.
(Perhaps interesting, perhaps not) and I would imagine that there will be also if the APU2 board is fully ready
one for the APU2 too.
Alix Boards
APU1 Board

Also a single or dual case for some PC Engines boards are able to get from here.
19" DualRack System for PC Engines ALIX, APU Board

Some questions from me about the APU will be;

Is the WebGui running smooth and liquid?
Is it faster then the APU1 or significant faster then the older Alix boards?
Can anyone do perhaps an IPSec speed test with the AES-NI module loaded?

dugeem

@BlueKobold:

But otherwise I would recommend to enable PowerD (hi adaptive).

Thanks - that is what I have configured.
NB Enabling this in pfSense 2.2 resulting in some log spamming (as above) but haven't seen this issue in 2.3.

Would you share the full name of the mSATA please? Another user is searching for one that is 100% compatible
with pfSense and able to support TRIM too. Thread about that

Sure - it is a Toshiba HG6 128GB mSata (THNSNJ128GMCU). Works well (including Trim) although I don't think it is the fastest SSD around … but for my pfSense installation it is fine.

What kind of APU2xx you are running now exactly? With 2 GB or 4 GB of RAM?

You've already quoted me where I mentioned that I'm running a apu2b4 ;) … so 4GB RAM available

And why the older Alix board was not running out of RAM?

The 256MB of RAM in my old Alix 2D13 was insufficient. Occasionally it would run out of memory when booting (although this happened less with pfSense 2.2 release series). Also it would struggle with a large number of FW states - although I tuned the PF parameters to timeout UDP states after 30 seconds.

If someone is bricking his BIOS there is also even a BIOS recovery solution for nearly all PC Engines Boards.

Good to know - although I have had no problems flashing the APU2 BIOS - I simply followed the instructions ;D

Some questions from me about the APU will be;

Is the WebGui running smooth and liquid?

Is it faster then the APU1 or significant faster then the older Alix boards?

Can anyone do perhaps an IPSec speed test with the AES-NI module loaded?

The pfSense 2.3-RC WebGUI is very good and loads quickly on the APU2. When I get time I will run up 2.3 on the old Alix and do some comparison - certainly the pfSense 2.2 GUI was a bit sluggish on the Alix.
Speed wise the APU2 really is much faster than the ALIX - not surprising given the change from a 500MHz single core AMD Geode to a 1GHz quad core AMD GX-412TC. In fact for me it is probably overkill … but I'm likely to get 100Mb/s broadband next year so it will better handle that. The APU2 has Intel GigE chipsets and AESNI hardware - which also helps increase performance.
Unfortunately I don't use IPSEC so can't really give you any objective performance data but you can probably get a rough idea of AESNI performance with the OpenSSL benchmark results above.

Cheers

dw

I recently got 250/100Mbit connection and wounder whats the preformance?
If the board can make OpenVPN/IPsec 100Mbit/s?

I have seen the APU1D4 can make around ~40 mbit/s.

The difference is that the APU2 have the double CPU power than APU1, AES-NI support and Intel NICs.

If the board can make OpenVPN/IPsec 100Mbit/s?

IPSec by using AES-GCM is going to show results around of 400% of the normal throughput or plain
a 4 time higher throughput and OpenVPN will not showing that. In OpenVPN 2.4 also AES-GCM will
be inside and will then giving you perhaps also that throughput too.

I have seen the APU1D4 can make around ~40 mbit/s.

IPSec or OpenVPN?

The difference is that the APU2 have the double CPU power than APU1, AES-NI support and Intel NICs.

Not really, it comes with 2 more CPU cores but also on 1,0GHz cpu frequency as the APU1 seris.
AES-NI and Intel ports is right and also very nice to have as I see it right.

movax

BTW> I reported my experienced with APU2C4 here https://forum.pfsense.org/index.php?topic=108231.msg612643#msg612643 , some other benchmarks and power usage included.

The aes performance is the same as reported here.

ktk

Did anyone actually manage to boot PFsense 2.3 on APU2? I ran into an issue as reported here https://forum.pfsense.org/index.php?topic=110366.0

@ktk:

Did anyone actually manage to boot PFsense 2.3 on APU2? I ran into an issue as reported here https://forum.pfsense.org/index.php?topic=110366.0

What is the BIOS version you are using? The latest one will be from the 3/11/2016.

update to the latest BIOS
prepare a USB pen drive to install from with the right and matching 2.3-amd64-memstick-console-image
insert a mSATA or HDD/SSD drive
connect via console via Putty (please set Putty to 115200 8/N/1 and the BIOS settings
too pfSense is coming by default with that settings)
change the boot order to USB and do a reboot please
install form the USB pen drive and change after that the boot order back to mSATA, HDD/SSD and reboot again

ktk

Hi Frank,

@BlueKobold:

@ktk:

Did anyone actually manage to boot PFsense 2.3 on APU2? I ran into an issue as reported here https://forum.pfsense.org/index.php?topic=110366.0

What is the BIOS version you are using? The latest one will be from the 3/11/2016.

update to the latest BIOS

prepare a USB pen drive to install from with the right and matching 2.3-amd64-memstick-console-image

insert a mSATA or HDD/SSD drive

connect via console via Putty (please set Putty to 115200 8/N/1 and the BIOS settings
too pfSense is coming by default with that settings)

change the boot order to USB and do a reboot please

install form the USB pen drive and change after that the boot order back to mSATA, HDD/SSD and reboot again

I am on latest bios already. I tried booting on SD card and from USB stick, neither did work. The SD card cannot mount ufs:/dev/ufs/pfsense0 and with USB stick I had so many errors reported on my console that I couldn't see which one actually triggered it.

mattlach

@ktk:

Hi Frank,

@BlueKobold:

@ktk:

Did anyone actually manage to boot PFsense 2.3 on APU2? I ran into an issue as reported here https://forum.pfsense.org/index.php?topic=110366.0

What is the BIOS version you are using? The latest one will be from the 3/11/2016.

update to the latest BIOS

prepare a USB pen drive to install from with the right and matching 2.3-amd64-memstick-console-image

insert a mSATA or HDD/SSD drive

connect via console via Putty (please set Putty to 115200 8/N/1 and the BIOS settings
too pfSense is coming by default with that settings)

change the boot order to USB and do a reboot please

install form the USB pen drive and change after that the boot order back to mSATA, HDD/SSD and reboot again

I am on latest bios already. I tried booting on SD card and from USB stick, neither did work. The SD card cannot mount ufs:/dev/ufs/pfsense0 and with USB stick I had so many errors reported on my console that I couldn't see which one actually triggered it.

I had issues installing using the 2.3.1 serial console images. The memstick version had problems writing to partitions in the dmesg, and the CD ISO couldn't mount the root partition of the installer at all, all resulting in an error console, and thus no pfSense installer.

On a whim, I downloaded the previous memstick installer from the mirror (2.3, instead of 2.3.1) and this installed just fine. I was then able to use the web interface to upgrade to 2.3.1_1 without any issues.

mattlach

@BlueKobold:

Nice and interesting thread about the new APU2 board.

For the APU I can say we were getting something around ~500+ MBit/s at the WAN Port and with enabled
PowerD (hi adaptive) we got ~650 MBit/s as throughput. Perhaps this will be different from the APU2 with
a quad core CPU. But otherwise I would recommend to enable PowerD (hi adaptive).

In 2.3.1_1 I wind up getting ~595Mbit/s throughput (as tested with iperf) without enabling PowerD. Enabling PowerD in the web interface does not seem to affect throughput speed, whether set to hidaptive or not, but it also seems to have no impact on idle power consumption, which hovers between 5.8W-6.5W regardless of whether PowerD is on or off. It makes me wonder if it is working at all. Either way, if it is not making a difference on power consumption, I might just leave it off.

I also don't get any CPU temp output like I do with my Intel based box. I was a little concerned about CPU temp due to the passive cooling setup just using the case to cool it, but it is a very low wattage part, so maybe that is silly of me. Feeling the case, it doesn't feel too hot. (In fact it barely gets warm)

hda

@mattlach:

I also don't get any CPU temp output like I do with my Intel based box. I was a little concerned about CPU temp due to the passive cooling setup just using the case to cool it, but it is a very low wattage part, so maybe that is silly of me. Feeling the case, it doesn't feel too hot. (In fact it barely gets warm)

Firmware has testmode and it reports T as about 55 Celsius if with correct coolpad, else may fry (90 C) after 8 minutes…

No GUI temps is due to missing FreeBSD code.

apollo17

To fix cpu temps follow the guide here https://forum.pfsense.org/index.php?topic=108262.0

My temps stay around 55-60 degrees c

edwardwong

Your CPU has 4 cores, can you test with "-multi 4" option to run 4 threads together? Then we can see the actual speed for this CPU.

@dugeem:

With aesni kernel module loaded:


openssl speed -elapsed -evp aes-128-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc       1527.90k     5867.93k    21607.17k    65414.14k   162611.20k

openssl speed -elapsed -evp aes-256-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-cbc       1512.18k     5761.15k    20833.28k    58732.20k   127229.95k

With aesni kernel module unloaded (i.e. use openssl internal AES-NI support):


openssl speed -elapsed -evp aes-128-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc     125586.59k   174393.26k   213315.07k   226097.49k   230883.33k

openssl speed -elapsed -evp aes-256-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-cbc     100216.39k   136148.85k   157464.49k   162677.42k   165601.28k

Zebibyte

Here is what I got trying the same command with -multi 4

openssl speed -elapsed -evp aes-128-cbc -multi 4
evp 5582.70k 22238.25k 81301.33k 244524.47k 593181.72k

openssl speed -elapsed -evp aes-256-cbc -multi 4
evp 5615.02k 21855.49k 77674.24k 220074.67k 465368.41k

Then after setting "Cryptographic Hardware" in the GUI back to none (not sure if this does the right thing)

openssl speed -elapsed -evp aes-128-cbc -multi 4
evp 5645.37k 19885.66k 70725.03k 217378.47k 524483.65k

openssl speed -elapsed -evp aes-256-cbc -multi 4
evp 5586.90k 21842.43k 77226.75k 219488.40k 455090.18k

@edwardwong:

Your CPU has 4 cores, can you test with "-multi 4" option to run 4 threads together? Then we can see the actual speed for this CPU.

@dugeem:

With aesni kernel module loaded:


openssl speed -elapsed -evp aes-128-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc       1527.90k     5867.93k    21607.17k    65414.14k   162611.20k

openssl speed -elapsed -evp aes-256-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-cbc       1512.18k     5761.15k    20833.28k    58732.20k   127229.95k

With aesni kernel module unloaded (i.e. use openssl internal AES-NI support):


openssl speed -elapsed -evp aes-128-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc     125586.59k   174393.26k   213315.07k   226097.49k   230883.33k

openssl speed -elapsed -evp aes-256-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-cbc     100216.39k   136148.85k   157464.49k   162677.42k   165601.28k

AndrewZ

Just started to configure APU2C4 as a replacement for my old Alix 2D13.
I'm wandering if it is possible to see the current CPU frequency in a dashboard?

edwardwong

Impressive result.
BTW, using "-evp" will force using crypto hardware, so whatever you set in GUI doesn't really matter, maybe you should try to skip this option to see the difference.

@Zebibyte:

Here is what I got trying the same command with -multi 4

openssl speed -elapsed -evp aes-128-cbc -multi 4
evp 5582.70k 22238.25k 81301.33k 244524.47k 593181.72k

openssl speed -elapsed -evp aes-256-cbc -multi 4
evp 5615.02k 21855.49k 77674.24k 220074.67k 465368.41k

Then after setting "Cryptographic Hardware" in the GUI back to none (not sure if this does the right thing)

openssl speed -elapsed -evp aes-128-cbc -multi 4
evp 5645.37k 19885.66k 70725.03k 217378.47k 524483.65k

openssl speed -elapsed -evp aes-256-cbc -multi 4
evp 5586.90k 21842.43k 77226.75k 219488.40k 455090.18k

@edwardwong:
Your CPU has 4 cores, can you test with "-multi 4" option to run 4 threads together? Then we can see the actual speed for this CPU.

@dugeem:
With aesni kernel module loaded:
openssl speed -elapsed -evp aes-128-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc       1527.90k     5867.93k    21607.17k    65414.14k   162611.20k

openssl speed -elapsed -evp aes-256-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-cbc       1512.18k     5761.15k    20833.28k    58732.20k   127229.95k
With aesni kernel module unloaded (i.e. use openssl internal AES-NI support):
openssl speed -elapsed -evp aes-128-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-128-cbc     125586.59k   174393.26k   213315.07k   226097.49k   230883.33k

openssl speed -elapsed -evp aes-256-cbc
type             16 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
aes-256-cbc     100216.39k   136148.85k   157464.49k   162677.42k   165601.28k

apollo17

@AndrewZ:

Just started to configure APU2C4 as a replacement for my old Alix 2D13.
I'm wandering if it is possible to see the current CPU frequency in a dashboard?

See my previous post in this thread (post #17).

after following the details from here https://forum.pfsense.org/index.php?topic=108262.0 the dashboard temperature readout works perfectly.

AndrewZ

@apollo17:

after following the details from here https://forum.pfsense.org/index.php?topic=108262.0 the dashboard temperature readout works perfectly.

Indeed, I've noticed that post earlier and already implemented the workaround described on my system.
My question was about frequency, not temperature.
For some reasons I was able to see the current and the maximum frequency (600 and 1000 as I recall) very briefly only 2 times during the page reload. All other time I see only the following:

CPU Type AMD GX-412TC SOC
4 CPUs: 1 package(s) x 4 core(s)

apollo17

@AndrewZ:

@apollo17:

after following the details from here https://forum.pfsense.org/index.php?topic=108262.0 the dashboard temperature readout works perfectly.

Indeed, I've noticed that post earlier and already implemented the workaround described on my system.
My question was about frequency, not temperature.
For some reasons I was able to see the current and the maximum frequency (600 and 1000 as I recall) very briefly only 2 times during the page reload. All other time I see only the following:

CPU Type AMD GX-412TC SOC
4 CPUs: 1 package(s) x 4 core(s)

Sorry, my mistake i misread your post. I know what you mean mine does that aswell, i'm not sure if you can change it. If you have powerd enabled you can get a realtime frequency read out using the shell command powerd -v.

I don't think the dashboard freqency readout is just amd related, it behaves the same on intel systems too.